New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 657559 link

Starred by 1 user

Issue metadata

Status: Fixed
Owner:
Last visit > 30 days ago
Closed: Oct 2016
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug



Sign in to add a comment

Crash in SkOpSpan::windValue

Project Member Reported by ClusterFuzz, Oct 19 2016

Issue description

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=4671415674732544

Fuzzer: libfuzzer_skia_pathop_fuzzer
Job Type: libfuzzer_chrome_asan
Platform Id: linux

Crash Type: UNKNOWN READ
Crash Address: 0x000000000070
Crash State:
  SkOpSpan::windValue
  SkOpCoincidence::apply
  HandleCoincidence
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_asan&range=423149:423180

Minimized Testcase (0.50 Kb): https://cluster-fuzz.appspot.com/download/AMIfv9656o8opesZVYK4GOgpF0pF0oe3lAoD1Q9b50mxcmbWqx4hTBv4rY8CbA2fc-MR-IWkyWc9VIXZQ9ZH8g5xKMljDiWHZJHA0seTM0OS3yODIJqkzLL5HUK4AgVlDWkwksLBvTg-k9_OyRFVWG_j-6gny-fxnw?testcase_id=4671415674732544

Issue filed automatically.

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.
 
Owner: caryclark@chromium.org
Status: Assigned (was: Untriaged)
caryclark @ could you please look into this.please feel free to re-assigned back if needed. thanks in advance !
Owner: caryclark@google.com
Status: Started (was: Assigned)
Project Member

Comment 4 by bugdroid1@chromium.org, Oct 20 2016

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/18cdcb2bdaf1b95995c7a3cfd53ba72c4fe3b4cb

commit 18cdcb2bdaf1b95995c7a3cfd53ba72c4fe3b4cb
Author: skia-deps-roller <skia-deps-roller@chromium.org>
Date: Thu Oct 20 21:04:16 2016

Roll src/third_party/skia/ 916ca1d8a..61013b235 (7 commits).

https://chromium.googlesource.com/skia.git/+log/916ca1d8a02b..61013b235f47

$ git log 916ca1d8a..61013b235 --date=short --no-merges --format='%ad %ae %s'
2016-10-20 borenet Add retries to the InfraTests bot's "update go pkgs" step
2016-10-20 caryclark fix more chrome asan fuzzer failures
2016-10-20 liyuqian Make SkFixedRound/Ceil/FloorToFixed as inline func
2016-10-20 mtklein Add missing sse41::run_pipeline.
2016-10-20 liyuqian Use Analytic AA in SkAAClip.
2016-10-20 borenet gen_tasks.go: Use new helpers from specs package
2016-10-20 mtklein Turn on /OPT:REF and /OPT:ICF too.

BUG= 657411 , 657559 

Documentation for the AutoRoller is here:
https://skia.googlesource.com/buildbot/+/master/autoroll/README.md

If the roll is causing failures, see:
http://www.chromium.org/developers/tree-sheriffs/sheriff-details-chromium#TOC-Failures-due-to-DEPS-rolls

CQ_INCLUDE_TRYBOTS=master.tryserver.blink:linux_precise_blink_rel
TBR=mtklein@google.com

Review-Url: https://chromiumcodereview.appspot.com/2438613006
Cr-Commit-Position: refs/heads/master@{#426594}

[modify] https://crrev.com/18cdcb2bdaf1b95995c7a3cfd53ba72c4fe3b4cb/DEPS

Status: Fixed (was: Started)
Project Member

Comment 6 by ClusterFuzz, Oct 21 2016

ClusterFuzz has detected this issue as fixed in range 426526:426594.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=4671415674732544

Fuzzer: libfuzzer_skia_pathop_fuzzer
Job Type: libfuzzer_chrome_asan
Platform Id: linux

Crash Type: UNKNOWN READ
Crash Address: 0x000000000070
Crash State:
  SkOpSpan::windValue
  SkOpCoincidence::apply
  HandleCoincidence
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_asan&range=423149:423180
Fixed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_asan&range=426526:426594

Minimized Testcase (0.50 Kb): https://cluster-fuzz.appspot.com/download/AMIfv9656o8opesZVYK4GOgpF0pF0oe3lAoD1Q9b50mxcmbWqx4hTBv4rY8CbA2fc-MR-IWkyWc9VIXZQ9ZH8g5xKMljDiWHZJHA0seTM0OS3yODIJqkzLL5HUK4AgVlDWkwksLBvTg-k9_OyRFVWG_j-6gny-fxnw?testcase_id=4671415674732544

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 7 by sheriffbot@chromium.org, Nov 22 2016

Labels: -Restrict-View-EditIssue
Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Sign in to add a comment